recog 3.0.3 → 3.1.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (21) hide show
  1. checksums.yaml +4 -4
  2. checksums.yaml.gz.sig +0 -0
  3. data/README.md +45 -2
  4. data/lib/recog/fingerprint.rb +9 -2
  5. data/lib/recog/version.rb +1 -1
  6. data/recog/xml/dhcp_vendor_class.xml +535 -1
  7. data/recog/xml/dns_versionbind.xml +3 -3
  8. data/recog/xml/favicons.xml +156 -6
  9. data/recog/xml/ftp_banners.xml +23 -9
  10. data/recog/xml/html_title.xml +153 -6
  11. data/recog/xml/http_cookies.xml +73 -2
  12. data/recog/xml/http_servers.xml +256 -4
  13. data/recog/xml/http_wwwauth.xml +13 -1
  14. data/recog/xml/imap_banners.xml +0 -1
  15. data/recog/xml/smb_native_os.xml +1 -1
  16. data/recog/xml/smtp_banners.xml +7 -7
  17. data/recog/xml/snmp_sysdescr.xml +26 -5
  18. data/recog/xml/ssh_banners.xml +2 -2
  19. data.tar.gz.sig +0 -0
  20. metadata +2 -2
  21. metadata.gz.sig +0 -0
data/recog/xml/favicons.xml CHANGED
@@ -75,10 +75,21 @@
75
75
  <param pos="0" name="service.cpe23" value="cpe:/a:apache:tomcat:-"/>
76
76
  </fingerprint>
77
77
 
78
- <fingerprint pattern="^(?:b6341dfc213100c61db4fb8775878cec|cf2445dcb53a031c02f9b57e2199bc03)$">
78
+ <fingerprint pattern="^(?:b6341dfc213100c61db4fb8775878cec|cf2445dcb53a031c02f9b57e2199bc03|fe22dd2bb09daccf58256611ac491469)$">
79
79
  <description>Drupal CMS</description>
80
+ <!-- Original Drupal favicon https://github.com/drupal/drupal/blob/f0a16bf2a4d1524aa33b656533e37d977cca4802/core/misc/favicon.ico -->
81
+
80
82
  <example>b6341dfc213100c61db4fb8775878cec</example>
83
+ <!--
84
+ High definition Drupal favicon
85
+ Drupal 8.0.0 https://github.com/drupal/drupal/blob/2ace26881d7a67a396caea6a79437c7e4e629f98/core/misc/favicon.ico
86
+ Drupal Bartik 9.2+ https://github.com/drupal/drupal/blob/cfa3a480fca997eaecdca2c81c8035ec61308abe/core/themes/bartik/favicon.ico
87
+ -->
88
+
81
89
  <example>cf2445dcb53a031c02f9b57e2199bc03</example>
90
+ <!-- Drupal 9.2+ https://github.com/drupal/drupal/blob/cfa3a480fca997eaecdca2c81c8035ec61308abe/core/misc/favicon.ico -->
91
+
92
+ <example>fe22dd2bb09daccf58256611ac491469</example>
82
93
  <param pos="0" name="service.vendor" value="Drupal"/>
83
94
  <param pos="0" name="service.product" value="CMS"/>
84
95
  <param pos="0" name="service.certainty" value="0.5"/>
@@ -122,18 +133,27 @@
122
133
  <param pos="0" name="service.certainty" value="0.5"/>
123
134
  </fingerprint>
124
135
 
125
- <fingerprint pattern="^(?:1391664373e72311a656c4a5504682af|88717398db158e3330ce94fc1784e4a7|04d89d5b7a290334f5ce37c7e8b6a349|08aa365c2d0863df2735d386f77c22c2)$">
136
+ <fingerprint pattern="^(?:1391664373e72311a656c4a5504682af|88717398db158e3330ce94fc1784e4a7|04d89d5b7a290334f5ce37c7e8b6a349|08aa365c2d0863df2735d386f77c22c2|eadf13e6cac2efef4f0565e171f90953)$">
126
137
  <description>Atlassian Jira</description>
127
138
  <example>1391664373e72311a656c4a5504682af</example>
128
139
  <example>88717398db158e3330ce94fc1784e4a7</example>
129
140
  <example>04d89d5b7a290334f5ce37c7e8b6a349</example>
130
141
  <example>08aa365c2d0863df2735d386f77c22c2</example>
142
+ <example>eadf13e6cac2efef4f0565e171f90953</example>
131
143
  <param pos="0" name="service.vendor" value="Atlassian"/>
132
144
  <param pos="0" name="service.product" value="Jira"/>
133
145
  <param pos="0" name="service.certainty" value="0.5"/>
134
146
  <param pos="0" name="service.cpe23" value="cpe:/a:atlassian:jira:-"/>
135
147
  </fingerprint>
136
148
 
149
+ <fingerprint pattern="^2fa69f2bc9174ffc21fc3c7925da6862$">
150
+ <description>Atlassian Jira Service Management</description>
151
+ <example>2fa69f2bc9174ffc21fc3c7925da6862</example>
152
+ <param pos="0" name="service.vendor" value="Atlassian"/>
153
+ <param pos="0" name="service.product" value="Jira Service Management"/>
154
+ <param pos="0" name="service.cpe23" value="cpe:/a:atlassian:jira_service_management:-"/>
155
+ </fingerprint>
156
+
137
157
  <fingerprint pattern="^d9edf2a6f791120dea5f27ae4faf1212$">
138
158
  <description>Atlassian Bitbucket</description>
139
159
  <example>d9edf2a6f791120dea5f27ae4faf1212</example>
@@ -239,15 +259,42 @@
239
259
  <param pos="0" name="service.cpe23" value="cpe:/a:solarwinds:orion_platform:-"/>
240
260
  </fingerprint>
241
261
 
242
- <fingerprint pattern="^ee20526df4d69f7b02ee107458d8d679$">
262
+ <fingerprint pattern="^(?:ee20526df4d69f7b02ee107458d8d679|661b80a4dde45fee1079113ce0323336|9d2025c356a2876990266689c6b6290b)$">
243
263
  <description>ManageEngine ADAudit Plus</description>
244
264
  <example>ee20526df4d69f7b02ee107458d8d679</example>
265
+ <example>661b80a4dde45fee1079113ce0323336</example>
266
+ <example>9d2025c356a2876990266689c6b6290b</example>
245
267
  <param pos="0" name="service.vendor" value="ManageEngine"/>
246
268
  <param pos="0" name="service.product" value="ADAudit Plus"/>
247
269
  <param pos="0" name="service.certainty" value="0.5"/>
248
270
  <param pos="0" name="service.cpe23" value="cpe:/a:zohocorp:manageengine_adaudit_plus:-"/>
249
271
  </fingerprint>
250
272
 
273
+ <fingerprint pattern="^6d14f0aa6a61fe4780b94b42eed19e83$">
274
+ <description>ManageEngine ADManager Plus</description>
275
+ <example>6d14f0aa6a61fe4780b94b42eed19e83</example>
276
+ <param pos="0" name="service.vendor" value="ManageEngine"/>
277
+ <param pos="0" name="service.product" value="ADManager Plus"/>
278
+ <param pos="0" name="service.cpe23" value="cpe:/a:zohocorp:manageengine_admanager_plus:-"/>
279
+ </fingerprint>
280
+
281
+ <fingerprint pattern="^1b476eae7d17844198fa494251ba910a$">
282
+ <description>ManageEngine Analytics Plus</description>
283
+ <example>1b476eae7d17844198fa494251ba910a</example>
284
+ <param pos="0" name="service.vendor" value="ManageEngine"/>
285
+ <param pos="0" name="service.product" value="Analytics Plus"/>
286
+ <param pos="0" name="service.cpe23" value="cpe:/a:zohocorp:manageengine_analytics_plus:-"/>
287
+ </fingerprint>
288
+
289
+ <fingerprint pattern="^(?:a79bce1c22f081b0d1e38b142827a0e8|ae9449edb0067aa8c2c292acbe93da6a)$">
290
+ <description>ManageEngine AssetExplorer</description>
291
+ <example>a79bce1c22f081b0d1e38b142827a0e8</example>
292
+ <example>ae9449edb0067aa8c2c292acbe93da6a</example>
293
+ <param pos="0" name="service.vendor" value="ManageEngine"/>
294
+ <param pos="0" name="service.product" value="AssetExplorer"/>
295
+ <param pos="0" name="service.cpe23" value="cpe:/a:zohocorp:manageengine_assetexplorer:-"/>
296
+ </fingerprint>
297
+
251
298
  <fingerprint pattern="^895eea03838bb521717d632eec739e57$">
252
299
  <description>ManageEngine PAM360</description>
253
300
  <example>895eea03838bb521717d632eec739e57</example>
@@ -272,6 +319,23 @@
272
319
  <param pos="0" name="service.cpe23" value="cpe:/a:zohocorp:manageengine_access_manager_plus:-"/>
273
320
  </fingerprint>
274
321
 
322
+ <fingerprint pattern="^e47c25d118b2c56ce3d7c31786b32a56$">
323
+ <description>ManageEngine ServiceDesk Plus</description>
324
+ <example>e47c25d118b2c56ce3d7c31786b32a56</example>
325
+ <param pos="0" name="service.vendor" value="ManageEngine"/>
326
+ <param pos="0" name="service.product" value="ManageEngine ServiceDesk Plus"/>
327
+ <param pos="0" name="service.cpe23" value="cpe:/a:zohocorp:manageengine_servicedesk_plus:-"/>
328
+ </fingerprint>
329
+
330
+ <fingerprint pattern="^(?:4098755981824f02879b05ea2cc4da14|f8affc42a31d3c2fa044b882b4656bc9)$">
331
+ <description>ManageEngine SupportCenter Plus</description>
332
+ <example>4098755981824f02879b05ea2cc4da14</example>
333
+ <example>f8affc42a31d3c2fa044b882b4656bc9</example>
334
+ <param pos="0" name="service.vendor" value="ManageEngine"/>
335
+ <param pos="0" name="service.product" value="SupportCenter Plus"/>
336
+ <param pos="0" name="service.cpe23" value="cpe:/a:zohocorp:manageengine_supportcenter_plus:-"/>
337
+ </fingerprint>
338
+
275
339
  <fingerprint pattern="^e9d6d23a961ea23a3e961266876e0ffd$">
276
340
  <description>HPE OfficeConnect Switch</description>
277
341
  <example>e9d6d23a961ea23a3e961266876e0ffd</example>
@@ -1317,11 +1381,13 @@
1317
1381
  </fingerprint>
1318
1382
 
1319
1383
  <fingerprint pattern="^b56508cc967af50baddfd69596901dab$">
1320
- <description>ServerTech Sentry Switched CDU</description>
1384
+ <description>Server Technology Sentry Switched CDU</description>
1321
1385
  <example>b56508cc967af50baddfd69596901dab</example>
1322
- <param pos="0" name="hw.vendor" value="ServerTech"/>
1323
- <param pos="0" name="hw.device" value="Power Device"/>
1386
+ <param pos="0" name="os.vendor" value="Server Technology"/>
1387
+ <param pos="0" name="os.product" value="{hw.product} Firmware"/>
1388
+ <param pos="0" name="hw.vendor" value="Server Technology"/>
1324
1389
  <param pos="0" name="hw.product" value="Sentry Switched CDU"/>
1390
+ <param pos="0" name="hw.device" value="Power Device"/>
1325
1391
  <param pos="0" name="hw.certainty" value="0.5"/>
1326
1392
  </fingerprint>
1327
1393
 
@@ -2162,6 +2228,15 @@
2162
2228
  <param pos="0" name="service.cpe23" value="cpe:/a:papermerge:papermerge:-"/>
2163
2229
  </fingerprint>
2164
2230
 
2231
+ <fingerprint pattern="^(?:188caa0ab159a5ceaca86922c293f62f|fdfbcf58b378b0fba43ba86e41a824fe)$">
2232
+ <description>FileRun - self-hosted Google Drive alternative</description>
2233
+ <example>188caa0ab159a5ceaca86922c293f62f</example>
2234
+ <example>fdfbcf58b378b0fba43ba86e41a824fe</example>
2235
+ <param pos="0" name="service.vendor" value="FileRun"/>
2236
+ <param pos="0" name="service.product" value="FileRun"/>
2237
+ <param pos="0" name="service.cpe23" value="cpe:/a:filerun:filerun:-"/>
2238
+ </fingerprint>
2239
+
2165
2240
  <fingerprint pattern="^ed9a8c7810e8c9fb7035b6c3147c9a3a$">
2166
2241
  <description>SuiteCRM</description>
2167
2242
  <example>ed9a8c7810e8c9fb7035b6c3147c9a3a</example>
@@ -2196,4 +2271,79 @@
2196
2271
  <param pos="0" name="service.cpe23" value="cpe:/a:qdpm:qdpm:-"/>
2197
2272
  </fingerprint>
2198
2273
 
2274
+ <fingerprint pattern="^1ea465228fa40f5c89f899e51ccc02c9$">
2275
+ <description>OWASP Zed Attack Proxy (ZAP) - API Web UI</description>
2276
+ <example>1ea465228fa40f5c89f899e51ccc02c9</example>
2277
+ <param pos="0" name="service.vendor" value="OWASP"/>
2278
+ <param pos="0" name="service.product" value="Zed Attack Proxy"/>
2279
+ <param pos="0" name="service.cpe23" value="cpe:/a:owasp:zed_attack_proxy:-"/>
2280
+ </fingerprint>
2281
+
2282
+ <fingerprint pattern="^dbe63c6d86ca97a4b20420e932c5b0bb$">
2283
+ <description>CloudPanel - server control panel</description>
2284
+ <example>dbe63c6d86ca97a4b20420e932c5b0bb</example>
2285
+ <param pos="0" name="service.vendor" value="MGT-COMMERCE GmbH"/>
2286
+ <param pos="0" name="service.product" value="CloudPanel"/>
2287
+ </fingerprint>
2288
+
2289
+ <fingerprint pattern="^6b774f15b254a3d1548db63b6f411150$">
2290
+ <description>Control Web Panel (CWP) (formerly CentOS Web Panel) - web hosting control panel</description>
2291
+ <example>6b774f15b254a3d1548db63b6f411150</example>
2292
+ <param pos="0" name="service.vendor" value="Control Web Panel"/>
2293
+ <param pos="0" name="service.product" value="Control Web Panel"/>
2294
+ <param pos="0" name="service.cpe23" value="cpe:/a:control-webpanel:webpanel:-"/>
2295
+ <param pos="0" name="os.family" value="Linux"/>
2296
+ <param pos="0" name="os.product" value="Linux"/>
2297
+ </fingerprint>
2298
+
2299
+ <fingerprint pattern="^(?:4f12cccd3c42a4a478f067337fe92794|5af2c34a740cf3d0f509d93bcbb41ef6)$">
2300
+ <description>Cacti - network graphing solution</description>
2301
+ <example>4f12cccd3c42a4a478f067337fe92794</example>
2302
+ <example>5af2c34a740cf3d0f509d93bcbb41ef6</example>
2303
+ <param pos="0" name="service.vendor" value="Cacti"/>
2304
+ <param pos="0" name="service.product" value="Cacti"/>
2305
+ <param pos="0" name="service.cpe23" value="cpe:/a:cacti:cacti:-"/>
2306
+ </fingerprint>
2307
+
2308
+ <fingerprint pattern="^53cbf6dd6891950b338d4764f38655c5$">
2309
+ <description>Castopod - Fediverse-aware podcast server</description>
2310
+ <example>53cbf6dd6891950b338d4764f38655c5</example>
2311
+ <param pos="0" name="service.vendor" value="Ad Aures"/>
2312
+ <param pos="0" name="service.product" value="Castopod"/>
2313
+ </fingerprint>
2314
+
2315
+ <fingerprint pattern="^(?:b071172979419bb7d7b0591409b952dd|17a40681aad7097ac6e06002abf2e7ec|2f0df01346ace9afb440288feeb5d974)$">
2316
+ <description>Bitwarden Server</description>
2317
+ <example>b071172979419bb7d7b0591409b952dd</example>
2318
+ <example>17a40681aad7097ac6e06002abf2e7ec</example>
2319
+ <example>2f0df01346ace9afb440288feeb5d974</example>
2320
+ <param pos="0" name="service.vendor" value="Bitwarden"/>
2321
+ <param pos="0" name="service.product" value="Server"/>
2322
+ <param pos="0" name="service.cpe23" value="cpe:/a:bitwarden:server:-"/>
2323
+ </fingerprint>
2324
+
2325
+ <fingerprint pattern="^(?:9e8ba456e7e39ea364cc538959813719|86157069c9574d4c75b907e614d6a521)$">
2326
+ <description>Vaultwarden - unofficial Bitwarden compatible server</description>
2327
+ <example>9e8ba456e7e39ea364cc538959813719</example>
2328
+ <example>86157069c9574d4c75b907e614d6a521</example>
2329
+ <param pos="0" name="service.vendor" value="Vaultwarden"/>
2330
+ <param pos="0" name="service.product" value="Vaultwarden"/>
2331
+ </fingerprint>
2332
+
2333
+ <fingerprint pattern="^(?:fa73151a3a3b610eaca4a7a5a78cc775|16d472e9624492b9398e7645c46d1f25)$">
2334
+ <description>Fortra GoAnywhere MFT - managed file transfer</description>
2335
+ <example>fa73151a3a3b610eaca4a7a5a78cc775</example>
2336
+ <example>16d472e9624492b9398e7645c46d1f25</example>
2337
+ <param pos="0" name="service.vendor" value="Fortra"/>
2338
+ <param pos="0" name="service.product" value="GoAnywhere MFT"/>
2339
+ <param pos="0" name="service.cpe23" value="cpe:/a:helpsystems:goanywhere_managed_file_transfer:-"/>
2340
+ </fingerprint>
2341
+
2342
+ <fingerprint pattern="^f46baa8367ecf994a9c50ce7fb89f483$">
2343
+ <description>ConnectWise R1Soft Server Backup Manager (SBM)</description>
2344
+ <example>f46baa8367ecf994a9c50ce7fb89f483</example>
2345
+ <param pos="0" name="service.vendor" value="ConnectWise"/>
2346
+ <param pos="0" name="service.product" value="R1Soft Server Backup Manager"/>
2347
+ </fingerprint>
2348
+
2199
2349
  </fingerprints>
data/recog/xml/ftp_banners.xml CHANGED
@@ -1277,17 +1277,19 @@ more text</example>
1277
1277
  </fingerprint>
1278
1278
 
1279
1279
  <fingerprint pattern="^(ZBR-\d+) Version (\S+) ready\.?$">
1280
- <description>ZebraNet Print Server FTP</description>
1281
- <example os.product="ZBR-46686" os.version="7.02" hw.product="ZBR-46686">ZBR-46686 Version 7.02 ready.</example>
1282
- <example os.version="V56.17.5Z" os.product="ZBR-79071" hw.product="ZBR-79071">ZBR-79071 Version V56.17.5Z ready.</example>
1283
- <example os.version="7.02" os.product="ZBR-46687" hw.product="ZBR-46687">ZBR-46687 Version 7.02 ready.</example>
1284
- <param pos="0" name="os.vendor" value="ZebraNet"/>
1285
- <param pos="0" name="os.device" value="Print Server"/>
1286
- <param pos="1" name="os.product"/>
1280
+ <description>Zebra ZebraNet Print Server FTP</description>
1281
+ <example hw.product="ZBR-46686" os.version="7.02">ZBR-46686 Version 7.02 ready.</example>
1282
+ <example hw.product="ZBR-79071" os.version="V56.17.5Z">ZBR-79071 Version V56.17.5Z ready.</example>
1283
+ <example hw.product="ZBR-46687" os.version="7.02">ZBR-46687 Version 7.02 ready.</example>
1284
+ <param pos="0" name="os.vendor" value="Zebra"/>
1285
+ <param pos="0" name="os.family" value="ZebraNet"/>
1286
+ <param pos="0" name="os.product" value="{hw.product} Firmware"/>
1287
1287
  <param pos="2" name="os.version"/>
1288
- <param pos="0" name="hw.vendor" value="ZebraNet"/>
1289
- <param pos="0" name="hw.device" value="Print Server"/>
1288
+ <param pos="0" name="os.device" value="Print Server"/>
1289
+ <param pos="0" name="hw.vendor" value="Zebra"/>
1290
+ <param pos="0" name="hw.family" value="ZebraNet"/>
1290
1291
  <param pos="1" name="hw.product"/>
1292
+ <param pos="0" name="hw.device" value="Print Server"/>
1291
1293
  </fingerprint>
1292
1294
 
1293
1295
  <fingerprint pattern="^(ET(\S{1,32})) Dell (\S+ Laser Printer) FTP Server">
@@ -1792,6 +1794,18 @@ more text</example>
1792
1794
  <param pos="0" name="hw.device" value="Power Device"/>
1793
1795
  </fingerprint>
1794
1796
 
1797
+ <fingerprint pattern="^(Sentry Switched (?:PDU|CDU)) v(\d+(?:\.\d+)*[a-z](?:-[a-z][0-9])*) FTP server ready\.">
1798
+ <description>Server Technology Sentry Switched Device</description>
1799
+ <example hw.product="Sentry Switched PDU" os.product="Sentry Switched PDU Firmware" os.version="8.0w">Sentry Switched PDU v8.0w FTP server ready.</example>
1800
+ <example hw.product="Sentry Switched CDU" os.product="Sentry Switched CDU Firmware" os.version="7.1e-d1">Sentry Switched CDU v7.1e-d1 FTP server ready.</example>
1801
+ <param pos="0" name="os.vendor" value="Server Technology"/>
1802
+ <param pos="0" name="os.product" value="{hw.product} Firmware"/>
1803
+ <param pos="2" name="os.version"/>
1804
+ <param pos="0" name="hw.vendor" value="Server Technology"/>
1805
+ <param pos="1" name="hw.product"/>
1806
+ <param pos="0" name="hw.device" value="Power Device"/>
1807
+ </fingerprint>
1808
+
1795
1809
  <fingerprint pattern="^Printer's ftp server (?:\d+) Please login with USER and PASS\.$">
1796
1810
  <description>Weidmüller Printer</description>
1797
1811
  <example>Printer's ftp server 530 Please login with USER and PASS.</example>
data/recog/xml/html_title.xml CHANGED
@@ -921,11 +921,13 @@
921
921
  </fingerprint>
922
922
 
923
923
  <fingerprint pattern="^Sentry Switched CDU$">
924
- <description>Sentry Switched CDU</description>
924
+ <description>Server Technology Sentry Switched CDU</description>
925
925
  <example>Sentry Switched CDU</example>
926
- <param pos="0" name="hw.vendor" value="ServerTech"/>
927
- <param pos="0" name="hw.device" value="Power Device"/>
926
+ <param pos="0" name="os.vendor" value="Server Technology"/>
927
+ <param pos="0" name="os.product" value="{hw.product} Firmware"/>
928
+ <param pos="0" name="hw.vendor" value="Server Technology"/>
928
929
  <param pos="0" name="hw.product" value="Sentry Switched CDU"/>
930
+ <param pos="0" name="hw.device" value="Power Device"/>
929
931
  </fingerprint>
930
932
 
931
933
  <fingerprint pattern="^Emerson Network Power Rack PDU Card$">
@@ -2026,14 +2028,38 @@
2026
2028
  <param pos="0" name="service.cpe23" value="cpe:/a:manageengine:desktop_central:-"/>
2027
2029
  </fingerprint>
2028
2030
 
2029
- <fingerprint pattern="^ManageEngine ADAudit Plus$">
2030
- <description>ManageEngineADAudit Plus</description>
2031
- <example>ManageEngine ADAudit Plus</example>
2031
+ <fingerprint pattern="^ADAudit Plus$">
2032
+ <description>ManageEngine ADAudit Plus</description>
2033
+ <example>ADAudit Plus</example>
2032
2034
  <param pos="0" name="service.vendor" value="ManageEngine"/>
2033
2035
  <param pos="0" name="service.product" value="ADAudit Plus"/>
2034
2036
  <param pos="0" name="service.cpe23" value="cpe:/a:zohocorp:manageengine_adaudit_plus:-"/>
2035
2037
  </fingerprint>
2036
2038
 
2039
+ <fingerprint pattern="^ManageEngine - ADManager Plus$">
2040
+ <description>ManageEngine ADManager Plus</description>
2041
+ <example>ManageEngine - ADManager Plus</example>
2042
+ <param pos="0" name="service.vendor" value="ManageEngine"/>
2043
+ <param pos="0" name="service.product" value="ADManager Plus"/>
2044
+ <param pos="0" name="service.cpe23" value="cpe:/a:zohocorp:manageengine_admanager_plus:-"/>
2045
+ </fingerprint>
2046
+
2047
+ <fingerprint pattern="^ManageEngine AssetExplorer$">
2048
+ <description>ManageEngine AssetExplorer</description>
2049
+ <example>ManageEngine AssetExplorer</example>
2050
+ <param pos="0" name="service.vendor" value="ManageEngine"/>
2051
+ <param pos="0" name="service.product" value="AssetExplorer"/>
2052
+ <param pos="0" name="service.cpe23" value="cpe:/a:zohocorp:manageengine_assetexplorer:-"/>
2053
+ </fingerprint>
2054
+
2055
+ <fingerprint pattern="^ManageEngine Endpoint Central$">
2056
+ <description>ManageEngine Endpoint Central (formerly Desktop Central)</description>
2057
+ <example>ManageEngine Endpoint Central</example>
2058
+ <param pos="0" name="service.vendor" value="ManageEngine"/>
2059
+ <param pos="0" name="service.product" value="Endpoint Central"/>
2060
+ <param pos="0" name="service.cpe23" value="cpe:/a:zohocorp:manageengine_desktop_central:-"/>
2061
+ </fingerprint>
2062
+
2037
2063
  <fingerprint pattern="^ManageEngine PAM360$">
2038
2064
  <description>ManageEngine PAM360</description>
2039
2065
  <example>ManageEngine PAM360</example>
@@ -2058,6 +2084,30 @@
2058
2084
  <param pos="0" name="service.cpe23" value="cpe:/a:zohocorp:manageengine_access_manager_plus:-"/>
2059
2085
  </fingerprint>
2060
2086
 
2087
+ <fingerprint pattern="^ManageEngine ServiceDesk Plus$">
2088
+ <description>ManageEngine ServiceDesk Plus</description>
2089
+ <example>ManageEngine ServiceDesk Plus</example>
2090
+ <param pos="0" name="service.vendor" value="ManageEngine"/>
2091
+ <param pos="0" name="service.product" value="ManageEngine ServiceDesk Plus"/>
2092
+ <param pos="0" name="service.cpe23" value="cpe:/a:zohocorp:manageengine_servicedesk_plus:-"/>
2093
+ </fingerprint>
2094
+
2095
+ <fingerprint pattern="^ManageEngine ServiceDesk Plus - MSP$">
2096
+ <description>ManageEngine ServiceDesk Plus MSP</description>
2097
+ <example>ManageEngine ServiceDesk Plus - MSP</example>
2098
+ <param pos="0" name="service.vendor" value="ManageEngine"/>
2099
+ <param pos="0" name="service.product" value="ServiceDesk Plus MSP"/>
2100
+ <param pos="0" name="service.cpe23" value="cpe:/a:zohocorp:manageengine_servicedesk_plus_msp:-"/>
2101
+ </fingerprint>
2102
+
2103
+ <fingerprint pattern="^ManageEngine SupportCenter Plus$">
2104
+ <description>ManageEngine SupportCenter Plus</description>
2105
+ <example>ManageEngine SupportCenter Plus</example>
2106
+ <param pos="0" name="service.vendor" value="ManageEngine"/>
2107
+ <param pos="0" name="service.product" value="SupportCenter Plus"/>
2108
+ <param pos="0" name="service.cpe23" value="cpe:/a:zohocorp:manageengine_supportcenter_plus:-"/>
2109
+ </fingerprint>
2110
+
2061
2111
  <fingerprint pattern="^(ScanFront \d.+)Web Menu$">
2062
2112
  <!-- no space between the product model and "Web Menu" in the title -->
2063
2113
 
@@ -3942,6 +3992,14 @@
3942
3992
  <param pos="0" name="service.cpe23" value="cpe:/a:zimbra:collaboration:-"/>
3943
3993
  </fingerprint>
3944
3994
 
3995
+ <fingerprint pattern="^OpenKM$">
3996
+ <description>OpenKM - Open Source Document Management System</description>
3997
+ <example>OpenKM</example>
3998
+ <param pos="0" name="service.vendor" value="OpenKM"/>
3999
+ <param pos="0" name="service.product" value="OpenKM"/>
4000
+ <param pos="0" name="service.cpe23" value="cpe:/a:openkm:openkm:-"/>
4001
+ </fingerprint>
4002
+
3945
4003
  <fingerprint pattern="^\s*(?:\S)*\s*::\s*Mayan EDMS\s*$">
3946
4004
  <description>Mayan EDMS - open-source document management system</description>
3947
4005
  <example>:: Mayan EDMS</example>
@@ -3959,6 +4017,17 @@
3959
4017
  <param pos="0" name="service.cpe23" value="cpe:/a:papermerge:papermerge:-"/>
3960
4018
  </fingerprint>
3961
4019
 
4020
+ <fingerprint pattern="^(?:FileRun :: (?:Login|Installation))|(?:(?:\S)* :: Login \(powered by FileRun\))$">
4021
+ <description>FileRun - self-hosted Google Drive alternative</description>
4022
+ <example>FileRun :: Login</example>
4023
+ <example>FileRun :: Installation</example>
4024
+ <example>FileRun :: Login (powered by FileRun)</example>
4025
+ <example>App Title :: Login (powered by FileRun)</example>
4026
+ <param pos="0" name="service.vendor" value="FileRun"/>
4027
+ <param pos="0" name="service.product" value="FileRun"/>
4028
+ <param pos="0" name="service.cpe23" value="cpe:/a:filerun:filerun:-"/>
4029
+ </fingerprint>
4030
+
3962
4031
  <fingerprint pattern="^SuiteCRM$">
3963
4032
  <description>SuiteCRM</description>
3964
4033
  <example>SuiteCRM</example>
@@ -3994,6 +4063,84 @@
3994
4063
  <param pos="0" name="service.cpe23" value="cpe:/a:qdpm:qdpm:{service.version}"/>
3995
4064
  </fingerprint>
3996
4065
 
4066
+ <fingerprint pattern="^ZAP API UI$">
4067
+ <description>OWASP Zed Attack Proxy (ZAP) - API Web UI</description>
4068
+ <example>ZAP API UI</example>
4069
+ <param pos="0" name="service.vendor" value="OWASP"/>
4070
+ <param pos="0" name="service.product" value="Zed Attack Proxy"/>
4071
+ <param pos="0" name="service.cpe23" value="cpe:/a:owasp:zed_attack_proxy:-"/>
4072
+ </fingerprint>
4073
+
4074
+ <fingerprint pattern="^CloudPanel \| Log In$">
4075
+ <description>CloudPanel - server control panel</description>
4076
+ <example>CloudPanel | Log In</example>
4077
+ <param pos="0" name="service.vendor" value="MGT-COMMERCE GmbH"/>
4078
+ <param pos="0" name="service.product" value="CloudPanel"/>
4079
+ </fingerprint>
4080
+
4081
+ <fingerprint pattern="^(?:Login \| Control WebPanel|CWP \| User)$">
4082
+ <description>Control Web Panel (CWP) (formerly CentOS Web Panel) - web hosting control panel</description>
4083
+ <example>Login | Control WebPanel</example>
4084
+ <example>CWP | User</example>
4085
+ <param pos="0" name="service.vendor" value="Control Web Panel"/>
4086
+ <param pos="0" name="service.product" value="Control Web Panel"/>
4087
+ <param pos="0" name="service.cpe23" value="cpe:/a:control-webpanel:webpanel:-"/>
4088
+ <param pos="0" name="os.family" value="Linux"/>
4089
+ <param pos="0" name="os.product" value="Linux"/>
4090
+ </fingerprint>
4091
+
4092
+ <fingerprint pattern="^Graphs \(darkstat [^)]+\)$">
4093
+ <description>darkstat - network statistics gatherer</description>
4094
+ <example>Graphs (darkstat eth0)</example>
4095
+ <example>Graphs (darkstat lagg0.4091, lagg0.21, lagg0.101, lagg0.102, lagg0.4001, lagg0.4081)</example>
4096
+ <param pos="0" name="service.vendor" value="darkstat Project"/>
4097
+ <param pos="0" name="service.product" value="darkstat"/>
4098
+ </fingerprint>
4099
+
4100
+ <fingerprint pattern="^Login to Cacti$">
4101
+ <description>Cacti - network graphing solution</description>
4102
+ <example>Login to Cacti</example>
4103
+ <param pos="0" name="service.vendor" value="Cacti"/>
4104
+ <param pos="0" name="service.product" value="Cacti"/>
4105
+ <param pos="0" name="service.cpe23" value="cpe:/a:cacti:cacti:-"/>
4106
+ </fingerprint>
4107
+
4108
+ <fingerprint pattern="^Bitwarden Web Vault$">
4109
+ <description>Bitwarden Server</description>
4110
+ <example>Bitwarden Web Vault</example>
4111
+ <param pos="0" name="service.vendor" value="Bitwarden"/>
4112
+ <param pos="0" name="service.product" value="Server"/>
4113
+ <param pos="0" name="service.cpe23" value="cpe:/a:bitwarden:server:-"/>
4114
+ </fingerprint>
4115
+
4116
+ <fingerprint pattern="^Vaultwarden Web Vault$">
4117
+ <description>Vaultwarden - unofficial Bitwarden compatible server</description>
4118
+ <example>Vaultwarden Web Vault</example>
4119
+ <param pos="0" name="service.vendor" value="Vaultwarden"/>
4120
+ <param pos="0" name="service.product" value="Vaultwarden"/>
4121
+ </fingerprint>
4122
+
4123
+ <fingerprint pattern="^(?:GoAnywhere (\d+(?:\.\d+)*)(?: - \S{1,512})?|GoAnywhere Web Client - Login)$">
4124
+ <description>Fortra GoAnywhere MFT - managed file transfer</description>
4125
+ <example service.version="7.0.3">GoAnywhere 7.0.3</example>
4126
+ <example service.version="6.8.6">GoAnywhere 6.8.6 - Production</example>
4127
+ <example>GoAnywhere Web Client - Login</example>
4128
+ <param pos="0" name="service.vendor" value="Fortra"/>
4129
+ <param pos="0" name="service.product" value="GoAnywhere MFT"/>
4130
+ <param pos="1" name="service.version"/>
4131
+ <param pos="0" name="service.cpe23" value="cpe:/a:helpsystems:goanywhere_managed_file_transfer:{service.version}"/>
4132
+ </fingerprint>
4133
+
4134
+ <fingerprint pattern="^Server Backup Manager SE\s*(?:- .{1,512})?$">
4135
+ <description>ConnectWise R1Soft Server Backup Manager (SBM)</description>
4136
+ <example>Server Backup Manager SE</example>
4137
+ <example>Server Backup Manager SE </example>
4138
+ <example>Server Backup Manager SE - foo.bar</example>
4139
+ <example>Server Backup Manager SE - [1234] FooBar</example>
4140
+ <param pos="0" name="service.vendor" value="ConnectWise"/>
4141
+ <param pos="0" name="service.product" value="R1Soft Server Backup Manager"/>
4142
+ </fingerprint>
4143
+
3997
4144
  <!-- Specific Eltex fingerprints to enable CPE generation -->
3998
4145
 
3999
4146
  <fingerprint pattern="^Eltex - NTP-RG-1402G$">
data/recog/xml/http_cookies.xml CHANGED
@@ -681,6 +681,14 @@
681
681
  <param pos="0" name="service.certainty" value="0.5"/>
682
682
  </fingerprint>
683
683
 
684
+ <fingerprint pattern="^laravel_session=">
685
+ <description>Laravel PHP web application framework</description>
686
+ <example>laravel_session=eyJpdiI6IjZmcXM4SXZqNVQxY2U2UDVEb1V0SFE9PSIsInZhbHVlIjoiQlRUYXk2WEsxUkZmVU5lRXpBTlZkUURkUnphR0RGMTdaRDkxWHFLVGhtaUZwM0plaWR2aVMyeVQ5MmFzNlVFczVQUExpeDdhUUZveVlCOVUxMVA4dHp6ZUQrK0t3KzBUaVlxb2o4WUxleE1rb29GTlozZWF6cXpUUTRnNFpJTHUiLCJtYWMiOiI3ZGNhNzhmOGRmMWFmZmE5ZjFiYjQ5ODBlNGEwMjgzZWNiZGI2ZTI4ZjFmYWJkMmIxZTgwYzM2NjA1OThlNGNlIn0%3D; expires=Mon, 13-Mar-2023 18:21:13 GMT; Max-Age=7200; path=/; httponly; samesite=lax</example>
687
+ <param pos="0" name="service.vendor" value="Laravel"/>
688
+ <param pos="0" name="service.product" value="Laravel"/>
689
+ <param pos="0" name="service.cpe23" value="cpe:/a:laravel:laravel:-"/>
690
+ </fingerprint>
691
+
684
692
  <fingerprint pattern="^phpMyAdmin=">
685
693
  <description>phpMyAdmin web interface for MySQL and MariaDB</description>
686
694
  <example>phpMyAdmin=28600e9ff9772c871dacec70f9c5edaa; path=/; HttpOnly</example>
@@ -707,14 +715,52 @@
707
715
  <param pos="0" name="service.cpe23" value="cpe:/a:mongo-express_project:mongo-express:-"/>
708
716
  </fingerprint>
709
717
 
710
- <fingerprint pattern="^adscsrf=">
718
+ <fingerprint pattern="^(JSESSIONIDADMP|admpcsrf)=">
719
+ <description>ManageEngine ADManager Plus</description>
720
+ <example cookie="JSESSIONIDADMP">JSESSIONIDADMP=3A92A25349FECF56B7D7D6FF915545B5; Path=/; HttpOnly</example>
721
+ <example cookie="admpcsrf">admpcsrf=f5fe4a87-0365-4d04-a8e2-87b3c640092e;path=/;priority=high</example>
722
+ <param pos="1" name="cookie"/>
723
+ <param pos="0" name="service.vendor" value="ManageEngine"/>
724
+ <param pos="0" name="service.product" value="ADManager Plus"/>
725
+ <param pos="0" name="service.cpe23" value="cpe:/a:zohocorp:manageengine_admanager_plus:-"/>
726
+ </fingerprint>
727
+
728
+ <fingerprint pattern="^(JSESSIONIDADAP|adapcsrf)=">
729
+ <description>ManageEngine ADAudit Plus</description>
730
+ <example cookie="JSESSIONIDADAP">JSESSIONIDADAP=BB472B7AD767571D913190056ED594CB; Path=/; HttpOnly</example>
731
+ <example cookie="adapcsrf">adapcsrf=97fcd4a1-078f-487b-bd73-ca492ef05121;path=/;priority=high</example>
732
+ <param pos="1" name="cookie"/>
733
+ <param pos="0" name="service.vendor" value="ManageEngine"/>
734
+ <param pos="0" name="service.product" value="ADAudit Plus"/>
735
+ <param pos="0" name="service.cpe23" value="cpe:/a:zohocorp:manageengine_adaudit_plus:-"/>
736
+ </fingerprint>
737
+
738
+ <fingerprint pattern="^(JSESSIONIDADSSP|adscsrf)=">
711
739
  <description>ManageEngine ADSelfService Plus</description>
712
- <example>adscsrf=cffff6b5-bd68-4c35-92ef-e45127e68289;path=/;priority=high</example>
740
+ <example cookie="JSESSIONIDADSSP">JSESSIONIDADSSP=A7FECBD71C67184E929AF80715C29C20; Path=/; Secure; HttpOnly</example>
741
+ <example cookie="adscsrf">adscsrf=cffff6b5-bd68-4c35-92ef-e45127e68289;path=/;priority=high</example>
742
+ <param pos="1" name="cookie"/>
713
743
  <param pos="0" name="service.vendor" value="ManageEngine"/>
714
744
  <param pos="0" name="service.product" value="ADSelfService Plus"/>
715
745
  <param pos="0" name="service.cpe23" value="cpe:/a:zohocorp:manageengine_adselfservice_plus:-"/>
716
746
  </fingerprint>
717
747
 
748
+ <fingerprint pattern="^ad360csrf=">
749
+ <description>ManageEngine Active Directory 360 (AD360)</description>
750
+ <example>ad360csrf=03c99789-515c-4aa9-8823-7e2e8e8b3026;path=/;SameSite=None;Secure;priority=high</example>
751
+ <param pos="0" name="service.vendor" value="ManageEngine"/>
752
+ <param pos="0" name="service.product" value="AD360"/>
753
+ <param pos="0" name="service.cpe23" value="cpe:/a:zohocorp:manageengine_ad360:-"/>
754
+ </fingerprint>
755
+
756
+ <fingerprint pattern="^ZROPJSESSIONID=">
757
+ <description>ManageEngine Analytics Plus</description>
758
+ <example>ZROPJSESSIONID=FECE4724AC1990DBCC45DD3DA6CB3002; Path=/; Secure; HttpOnly</example>
759
+ <param pos="0" name="service.vendor" value="ManageEngine"/>
760
+ <param pos="0" name="service.product" value="Analytics Plus"/>
761
+ <param pos="0" name="service.cpe23" value="cpe:/a:zohocorp:manageengine_analytics_plus:-"/>
762
+ </fingerprint>
763
+
718
764
  <fingerprint pattern="^(dmid|opvc|sitevisitscookie)=">
719
765
  <description>dotCMS Content Management Platform</description>
720
766
  <example cookie="dmid">dmid=dcd46b93-54ab-4a43-a023-99154f879c3e; Max-Age=153792000; Expires=Thu, 18-Mar-2027 21:28:37 GMT; Path=/; HttpOnly; SameSite=Strict</example>
@@ -734,6 +780,31 @@
734
780
  <param pos="0" name="service.cpe23" value="cpe:/a:qdpm:qdpm:-"/>
735
781
  </fingerprint>
736
782
 
783
+ <fingerprint pattern="^cloudpanel=">
784
+ <description>CloudPanel - server control panel</description>
785
+ <example>cloudpanel=9rs2cohqs9bfq5fch54j2m5eje; path=/; secure; httponly; samesite=lax</example>
786
+ <param pos="0" name="service.vendor" value="MGT-COMMERCE GmbH"/>
787
+ <param pos="0" name="service.product" value="CloudPanel"/>
788
+ </fingerprint>
789
+
790
+ <fingerprint pattern="^cwpsrv-[0-9a-f]{32}=">
791
+ <description>Control Web Panel (CWP) (formerly CentOS Web Panel) - web hosting control panel</description>
792
+ <example>cwpsrv-5df9a64aa14f59216453d6f07164a7f1=aq0jsl5muvuli7cif5p9ut7dtm; path=/</example>
793
+ <param pos="0" name="service.vendor" value="Control Web Panel"/>
794
+ <param pos="0" name="service.product" value="Control Web Panel"/>
795
+ <param pos="0" name="service.cpe23" value="cpe:/a:control-webpanel:webpanel:-"/>
796
+ <param pos="0" name="os.family" value="Linux"/>
797
+ <param pos="0" name="os.product" value="Linux"/>
798
+ </fingerprint>
799
+
800
+ <fingerprint pattern="^FileRunSID=">
801
+ <description>FileRun - self-hosted Google Drive alternative</description>
802
+ <example>FileRunSID=966e9a0441b5fea1a72af53b1a6adc8f; path=/; HttpOnly</example>
803
+ <param pos="0" name="service.vendor" value="FileRun"/>
804
+ <param pos="0" name="service.product" value="FileRun"/>
805
+ <param pos="0" name="service.cpe23" value="cpe:/a:filerun:filerun:-"/>
806
+ </fingerprint>
807
+
737
808
  <!--
738
809
  Ignore various cookies that are very generic cookies for session IDs
739
810
  that are not necessarily indicative of any particular